In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations.
When a DNS server returns a response with the TC (Truncated) bit set, the ns_resolv function in the dnsproxy.c file may receive a lookup string with a NULL value or empty string. Such values cause incorrect buffer length calculations and incorrect memcpy operations. Consequently, memory corruption is possible, which can lead to a ConnMan process crash or—under favorable conditions—to arbitrary code execution.
An attacker can cause a ConnMan service failure (DoS) or potentially execute arbitrary code on the vulnerable system, gaining the ability to fully compromise it.
Patches available from the manufacturer should be applied according to references. It is recommended to monitor the ConnMan project repository (kernel.org) to obtain the patched version and deploy it as soon as possible. As a temporary workaround, it is worth considering restricting access to the DNS proxy service offered by ConnMan to trusted networks.
ConnMan in versions up to and including 1.44 (through 1.44)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H